Why Chromium Introduced Related Website Sets

The Chromium project introduced Related Website Sets (formerly known as First-Party Sets) to balance user privacy with essential web functionality as third-party cookies are phased out. This article explains why this mechanism was created, how it allows organizations owning multiple domains to maintain seamless user experiences like single sign-on, and how it prevents unrestricted cross-site tracking.

The Core Problem: The End of Third-Party Cookies

To improve user privacy and prevent pervasive cross-site tracking, the Chromium team developed the Privacy Sandbox initiative, which includes the deprecation of third-party cookies. Historically, web browsers determine whether a cookie is "first-party" or "third-party" based strictly on the top-level domain name.

Under strict third-party cookie blocking, a browser views company.com and company-support.com as two entirely unrelated websites. For large organizations, this strict separation breaks critical, non-tracking website functions that rely on shared cookies across different domains owned by the same entity.

The Solution: Defining Relationships Between Domains

Chromium introduced Related Website Sets (RWS) to solve this exact problem. RWS is a framework that allows an organization to publicly declare that a collection of different domains are owned and operated by the same entity. When the browser recognizes these domains as part of a single "set," it allows limited cross-site cookie access between them, preserving functionality while still blocking unauthorized third-party trackers.

Key Use Cases for Organizations

Organizations own multiple domains for a variety of legitimate operational, security, and branding reasons. Chromium designed RWS to support several specific scenarios:

  • Single Sign-On (SSO): Many organizations use a centralized authentication domain to log users into various properties. RWS allows a user to log in once on an account management domain and remain logged in across the company's other domains.
  • Country-Specific Domains: Global businesses often operate under different country-code top-level domains, such as brand.ca, brand.co.uk, and brand.de. RWS allows these sites to share user preferences and login states seamlessly.
  • Service and Security Isolation: Websites frequently host user-uploaded content or run payment processing on separate domains to protect the main website from security vulnerabilities (like cross-site scripting). RWS permits these backend utility domains to function alongside the main site.
  • Multi-Brand Ecosystems: A parent company may own several distinct brands that share a unified loyalty program, shopping cart, or customer support portal.

How It Works Under the Hood

Related Website Sets do not automatically grant free-flowing cookie access across declared domains. Instead, RWS works in tandem with the Storage Access API.

  1. Submission: An organization submits its proposed set of domains to a public GitHub repository managed by the Chromium project.
  2. Validation: Automated checks verify that the domains meet strict technical and policy criteria, such as sharing a common privacy policy and proving mutual ownership.
  3. API Integration: Once approved and integrated into the browser, websites within the set can use the requestStorageAccess or requestStorageAccessFor APIs to request cross-site cookies. Because the domains are in an approved set, the browser can automatically grant this access without interrupting the user with permission prompts.

Preventing Abuse and Protecting Privacy

To ensure organizations do not abuse Related Website Sets to recreate massive tracking networks, Chromium enforced strict guardrails. Unrelated companies cannot band together to form a set to share user data. Furthermore, Chromium limits the number of domains allowed in specific subsets to prevent the creation of sprawling, opaque networks. Because the entire list of sets is public, researchers and privacy advocates can audit the relationships, ensuring that RWS is only used for legitimate organizational needs.